Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting platforms like Discord, MediaFire, GitHub, and Dropbox.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google a Minecraft client like “Xenon Client” and click the top result, without thinking. That’s the WeedHack trap. WeedHack uses SEO poisoning and lookalike Minecraft client sites that promise free or cracked tools. You click download…and the file actually comes from Discord, MediaFire, GitHub, or Dropbox, not the real project site. Here’s the tell: a “free” version of a paid Minecraft tool, hosted on a generic link like Discord or MediaFire, and the URL doesn’t match the official client site. If the download is an unexpected EXE for a mod, that’s your red flag. One move: only download Minecraft clients and mods from the official project site you type in yourself, then let your security software scan the file before you run it.
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
